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DETAILED ACTION 

This Office Action is In response to Applicant's application 10578067, filed 
05/02/06. Claims 1-19, which are currently pending, are fully considered below. 

Priority 

This application is a 371 of PCT/IB04/52233, filed 10/28/04, which claims priority 
to foreign document EPO 031 04086.8, filed 1 1/05/03. 

Claim Rejections - 35 USC § 101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 1-19 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claims 1-12 are rejected because the claims are rejected as falling under the 
judicial exception of an abstract idea which lacks a useful, concrete, and tangible result. 
A claimed series of steps or acts that do not result in a useful, concrete, and tangible 
result are not statutory within the meaning of 35 USC 101 . In the instant case, the 
claims recite, "creating a control point," and "accessing services." However, no useful, 
concrete, and tangible result is claimed. For example, "writing said data," "updating said 
data," "sending said data" being claimed at the end of the claim may comprise a useful, 
concrete, and tangible result. Absent such a result, however, the claims are not 
statutory. 
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Claims 13-19 are rejected because the claims lack the necessary physical 
articles or objects to constitute a machine or a manufacture within the meaning of 35 
use 101 . They are clearly not a series of steps or acts to be a process nor are they a 
combination of chemical compounds to be a composition of matter. As such, they fail to 
fall within a statutory category. They are, at best, functional descriptive material perse. 

Descriptive material can be characterized as either "functional descriptive 
material" or "nonfunctional descriptive material." Both types of "descriptive material" are 
nonstatutory when claimed as descriptive material perse, 33 F.3d at 1360, 31 USPQ2d 
at 1759. When functional descriptive material is recorded on some computer-readable 
medium, it becomes structurally and functionally interrelated to the medium and will be 
statutory in most cases since use of technology permits the function of the descriptive 
material to be realized. Compare In re Lowry, 32 F.3d 1579, 1583-84, 32 USPQ2d 
1031, 1035 (Fed. Cir. 1994). 

Merely claiming nonfunctional descriptive material, i.e., abstract ideas, stored on 
a computer-readable medium, in a computer, or on an electromagnetic carrier signal, 
does not make it statutory. See Diehr, 450 U.S. at 185-86, 209 USPQ at 8 (noting that 
the claims for an algorithm in Benson were unpatentable as abstract ideas because 
"[t]he sole practical application of the algorithm was in connection with the programming 
of a general purpose computer."). 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 

USPQ 459 (1966), that are applied for establishing a background for determining 

obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

Claims 1-19 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Masuouka et al. (U.S. Patent Publication 20050138410) and further in view of Eytchison 

(WO 01/50290). 

With respect to claim 1 , Masuouka teaches generating a control point identity for 
the user based on a public key associated with the user (i.e. a control point identity is 
generated as a user requests and receives credentials to access a system, where the 
credentials may be based on public, or shared keys, [0074]). providing at least basic 
control point functionalities (i.e. while the users credentials remain valid, the user may 
access the system functions, [0075]), and such that the user can operate any device he 
is allowed to in the computing environment from any physical entity where the control 
point is enabled (i.e. user is granted physical access to any device where authentication 



Application/Control Number: Page 5 

10/578,067 

Art Unit: 2169 

is validated, [0044]). Masuouka does not explicitly disclose where the control point is 
stored. However, Eytchison teaches storing the control point identity and the 
functionalities as a control point (i.e. server stores policy statements, or information 
about the user and. their functionalities, (page 11)). Masuouka and Eytchison are 
analogous art because they are from the same field of endeavor of allowing a user to 
access devices based on access permissions. At the time of the invention, it would have 
been obvious to one of ordinary skill in the art, having the teachings of Masuouka and 
Eytchison before him or her, to modify the system of Masuouka with the teachings of 
Eytchison in order to protect devices from access by unauthorized users (Eytchison, 
page 3). The motivation for doing so would have been to add a user-dependent access 
control system for a network of electronic devices (Eytchison, page 3). Therefore, it 
would have been obvious to combine Eytchison with Masuouka to obtain the invention 
as specified in the instant claim(s). 

With respect to claim 2, Masuouka teaches how a user is granted access to a 
device ([0014). Masuouka does not explicitly disclose that a control point is stored on a 
server. However, Eytchison teaches the control point is stored on a server that an entity 
through which a user can access a device can reach (i.e. server stores policy 
statements, or information about the user and their access to devices in the system, and 
for controlling the devices, (page 11)). Therefore, the limitations of claim 2 are rejected 
in the analysis of claim 1 above, and the claim is rejected on that basis. 

With respect to claim 3, Masuouka teaches the control point is stored on a smart 
card of the user (i.e. control point is stored on a smart card or token, [0066]). 
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With respect to claim 4, Masuouka teaches a replica of the control point is stored 
in each device the user can be allowed to control (i.e. control point information, like 
certificates and keys, may be installed on the device, [0074]). 

With respect to claim 5, Masuouka teaches the connectivity model is Universal 
Plug and Play (i.e. Universal Plug and Play (UPnP) networks control the client devices, 
[0142]). 

With respect to claim 6, Masuouka teaches identifying a user wanting to access 
sen/ices at a point of access for the user to the computing environment by using a 
control point identifier (i.e. user requests access to the environment using a control point 
identifier, or pin, [0014]), detennining if there is a control point associated with the user 
existing at the point of access (i.e. system determines if pin and user are valid for the 
point of access, [0156]). Masuouka does not explicitly disclose how a control point is 
registered on a security console. However, Eytchison teaches copying, if there is no 
such control point at the point of access, the control point to the point of access (i.e. if 
user has not already set up a profile, request will be sent for services (page 14)), 
activating the control point (i.e. system grants service request if all needed information 
is available, and the resource manager will automatically configure the devices of the 
network accordingly, (page 14)), and connecting the control point with a device, such 
that the user can access services from the device in dependence of the fights granted to 
him (i.e. user will be allowed access to the devices to which he has privilege, (page 
14)). Masuouka and Eytchison are analogous art because they are from the same field 
of endeavor of allowing a user to access devices based on access permissions. At the 
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time of the invention, it would have been obvious to one of ordinary skill in the art, 
having the teachings of Masuouka and Eytchison before him or her, to modify the 
system of Masuouka with the teachings of Eytchison in order to protect devices from 
access by unauthorized users (Eytchison, page 3). The motivation for doing so would 
have been to add a user-dependent access control system for a network of electronic 
devices (Eytchison, page 3). Therefore, it would have been obvious to combine 
Eytchison with Masuouka to obtain the invention as specified in the instant claim(s). 

With respect to claim 7, Masuouka teaches the step of identifying comprises 
performing authentication of the user using the public key and a secret key of the user 
(i.e. authentification requires public and private keys, [0046]). 

With respect to claim 8, Masuouka teaches how a user is granted access to a 
device ([0014). Masuouka does not explicitly disclose copying a control point. However, 
Eytchison teaches the step of copying comprises copying the control point from a 
known user control point store (i.e. profile can be copied from home server system, 
page 13). Therefore, the limitations of claim 8 are rejected in the analysis of claim 6 
above, and the claim is rejected on that basis; 

With respect to claim 9, Masuouka teaches how a user is granted access to a 
device ([0014). Masuouka does not explicitly disclose how a control point is registered 
on a security console. However, Eytchison teaches registering the control point at a 
security console using the control point identifier (i.e. control point access information is 
stored in the access control manager (ACM) to determine the identifier of the user, 
(page 14)), and granting permission to the control point regarding at least one device 



Application/Control Number: Page 8 

10/578.067 

Art Unit: 2169 

from the security console, such that a user can access services of the device via the 
control point (i.e. the access control manager enables access for the user to the devices 
based on user control point privileges, (page 14)). Therefore, the limitations of claim 9 
are rejected in the analysis of claim 6 above, and the claim is rejected on that basis. 

With respect to claim 10, Masuouka teaches how a user is granted access to a 
device ([0014). Masuouka does not explicitly disclose that access permissions are 
determined by an access control list. However, Eytchlson teaches the step of granting 
permission comprises storing the control point identifier in an action control list 
associated with the device in question (i.e. granting permissions may be facilitated by 
an access control manager, which has profiles stored with their approved access levels, 
(page 13)). Therefore, the limitations of claim 10 are rejected in the analysis of claim 9 
above, and the claim is rejected on that basis. 

With respect to claim 1 1 , Masuouka teaches the step of granting permission 
comprises providing the control point with a ticket to be used for accessing services of 
the device (i.e. to grant access to the system, a ticket, or pin is used. [0046]). 

With respect to claim 12, Masuouka teaches how a user is granted access to a 
device ([0014). Masuouka does not explicitly disclose that the security console 
determines the access rights. However, Eytchison teaches the step of accessing the 
services using access rights provided by a security console (i.e. user accesses devices 
based on access rights stored in the access control, or security manager, (page 14)). 
Therefore, the limitations of claim 12 are rejected in the analysis of claim 9 above, and 
the claim is rejected on that basis. 
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With respect to claim 13, Masuouka teaches generate a control point identity for 
the user based on a public key associated with the user (i.e. a control point identity is 
generated as a user requests and receives credentials to access a system, where the 
credentials may be based on public, or shared keys, [0074]), provide at least basic 
control point functionalities (i.e. while the users credentials remain valid, the user may 
access the system functions, [0075]), and such that the user can operate any device he 
is allowed to in the computing environment from any physical entity where the control 
point is enabled (i.e. user Is granted physical access to any device where authentication 
is validated, [0044]). Masuouka does not explicitly disclose where the control point is 
stored. However, Eytchison teaches store the control point identity and the 
functionalities as a control point (30) (i.e. server stores policy statements, or information 
about the user and their functionalities, (page 11)). Masuouka and Eytchison are 
analogous art because they are from the same field of endeavor of allowing a user to 
access devices based on access permissions. At the time of the invention, it would have 
been obvious to one of ordinary skill in the art, having the teachings of Masuouka and 
Eytchison before him or her, to modify the system of Masuouka with the teachings of 
Eytchison in order to protect devices from access by unauthorized users (Eytchison, 
page 3). The motivation for doing so would have been to add a user-dependent access 
control system for a network of electronic devices (Eytchison, page 3). Therefore, it 
would have been obvious to combine Eytchison with Masuouka to obtain the invention 
as specified in the instant claim(s). 
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With respect to claim 14, Masuouka teaches identify a user wanting to access 
services at a point of access (12) for the user to the computing environment by using a 
control point identifier (i.e. user requests access to the environment using a control point 
identifier, or pin, [0014]), determine if there is a control point (30) associated with the 
user existing at the point of access (i.e. system determines if pin and user are valid for 
the point of access, [0156]). Masuouka does not explicitly disclose how a control point is 
registered on a security console. However, Eytchison teaches copy, if there is no such 
control point at the point of access, the control point to the point of access (i.e. if user 
has not already set up a profile, request will be sent for services (page 14)), activate the 
control point (i.e. system grants service request if all needed information is available, 
and the resource manager will automatically configure the devices of the network 
accordingly, (page 14)), and connect the control point with a device (38), such that the 
user can access services from the device in dependence of the rights granted to him 
(i.e. user will be allowed access to the devices to which he has privilege, (page 14)). 
Masuouka and Eytchison are analogous art because they are from the same field of 
endeavor of allowing a user to access devices based on access permissions. At the 
time of the invention, it would have been obvious to one of ordinary skill in the art, 
having the teachings of Masuouka and Eytchison before him or her, to modify the 
system of Masuouka with the teachings of Eytchison in order to protect devices from 
access by unauthorized users (Eytchison, page 3). The motivation for doing so would 
have been to add a user-dependent access control system for a network of electronic 
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devices (Eytchison, page 3). Therefore, it would have been obvious to combine 
Eytchison with Masuouka to obtain the invention as specified in the instant claim(s). 

With respect to claim 15, Masuouka teaches generate a control point identity for 
the user based on a public key associated with the user (i.e. a control point identity is 
generated as a user requests and receives credentials to access a system, where the 
credentials may be based on public, or shared keys, [0074]), provide at least basic 
control point functionalities (i.e. while the users credentials remain valid, the user may 
access the system functions, [0075]), such that the user can operate any device (38) he 
is allowed to in the computing environment from any physical entity (12, 18, 20, 22) 
where the control point is enabled (i.e. user is granted physical access to any device 
where authentication is validated, [0044]), identify a user wanting to access services at 
a point of access (12) for the user to the computing environment by using a control point 
identifier (i.e. user requests access to the environment using a control point identifier, or 
pin, [0014]), determine if there is a control point associated with the user existing at the 
point of access (i.e. system determines if pin and user are valid for the point of access, 
[0156]). Masuouka does not explicitly disclose where the control point is stored. 
However. Eytchison teaches store the control point identity and the functionalities as a 
control point (30) (i.e. server stores policy statements, or information about the user and 
their functionalities, (page 1 1 )), copy, if there is no such control point at the point of 
access, the control point to the point of access (i.e. if user has not already set up a 
profile, request will be sent for services (page 14)), activate the control point (i.e. system 
grants service request if all needed information is available, and the resource manager 
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will automatically configure the devices of the network accordingly, (page 14)). and 
connect the control point with a device (38). such that the user can access services 
from the device in dependence of the rights granted to him (i.e. user will be allowed 
access to the devices to which he has privilege, (page 14)). Masuouka and Eytchison 
are analogous art because they are from the same field of endeavor of allowing a user 
to access devices based on access permissions. At the time of the invention, it would 
have been obvious to one of ordinary skill in the art, having the teachings of Masuouka 
and Eytchison before him or her, to modify the system of Masuouka with the teachings 
of Eytchison in order to protect devices from access by unauthorized users (Eytchison, 
page 3). The motivation for doing so would have been to add a user-dependent access 
control system for a network of electronic devices (Eytchison, page 3). Therefore, it 
would have been obvious to combine Eytchison with Masuouka to obtain the invention 
as specified in the instant claim(s). 

With respect to claim 16, Masuouka teaches computer program code means, to 
make the computer execute, when said program is loaded in the computer (claim 26), 
generate a control point identity for the user based on a public key associated with the 
user (i.e. a control point identity is generated as a user requests and receives 
credentials to access a system, where the credentials may be based on public, or 
shared keys, [0074]), provide at least basic control point functionalities (i.e. while the 
users credentials remain valid, the user may access the system functions, [0075]). and 
such that the user can operate any device he is allowed to in the computing 
environment from any physical entity where the control point is enabled (i.e. user is 
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granted physical access to any device where authentication is validated, [0044]). 
Masuouka does not explicitly disclose where the control point is stored. However, 
Eytchison teaches store the control point identity and the functionalities as a control 
point (i.e. server stores policy statements, or information about the user and their 
functionalities, (page 11). Masuouka and Eytchison are analogous art because they are 
from the same field of endeavor of allowing a user to access devices based on access 
permissions. At the time of the invention, it would have been obvious to one of ordinary 
skill In the art, having the teachings of Masuouka and Eytchison before him or her, to 
modify the system of Masuouka with the teachings of Eytchison In order to protect 
devices from access by unauthorized users (Eytchison, page 3). The motivation for 
doing so would have been to add a user-dependent access control system for a network 
of electronic devices (Eytchison, page 3). Therefore, It would have been obvious to 
combine Eytchison with Masuouka to obtain the invention as specified in the instant 
claim(s). 

With respect to claim 17, Masuouka teaches identify a user wanting to access 
services at a point of access for the user to the computing environment by using a 
control point Identifier (I.e. user requests access to the environment using a control point 
identifier, or pin, [0014]), determine if there Is a control point associated with the user 
existing at the point of access (I.e. system detemriines If pin and user are valid for the 
point of access, [0156]). Masuouka does not explicitly disclose how a control point is 
registered on a security console. However, Eytchison teaches computer program code 
means, to make the computer execute, when said program is loaded in the computer 
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(claim 26), copy, if there is no such control point at the point of access, the control point 
to the point of access (i.e. if user has not already set up a profile, request will be sent for 
services (page 14)), activate the control point (i.e. system grants service request if all 
needed information is available, and the resource manager will automatically configure 
the devices of the network accordingly, (page 14)), and connect the control point with a 
device, such that the user earl access services from the device in dependence of the 
rights granted to him (i.e. user will be allowed access to the devices to which he has 
privilege, (page 14)). Masuouka and Eytchison are analogous art because they are from 
the same field of endeavor of allowing a user to access devices based on access 
pemiissions. At the time of the invention, it would have been obvious to one of ordinary 
skill in the art, having the teachings of Masuouka and Eytchison before him or her, to 
modify the system of Masuouka with the teachings of Eytchison In order to protect 
devices from access by unauthorized users (Eytchison, page 3). The motivation for 
doing so would have been to add a user-dependent access control system for a network 
of electronic devices (Eytchison, page 3). Therefore, it would have been obvious to 
combine Eytchison with Masuouka to obtain the invention as specified in the instant 
claim(s). 

With respect to claim 18, Masuouka teaches computer program code means, to 
make the computer execute, when said program element is loaded in the computer 
(claim 26), generate a control point identity for the user based on a public key 
associated with the user (i.e. a control point identity is generated as a user requests and 
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receives credentials to access a system, where the credentials may be based on public, 
or shared keys, [0074]), provide at least basic control point functionalities (i.e. while the 
users credentials remain valid, the user may access the system functions, [0075]), and 
such that the user can operate any device he is allowed to in the computing 
environment from any physical entity where the control point is enabled (i.e. user is 
granted physical access to any device where authentication is validated, [0044]). 
Masuouka does not explicitly disclose where the control point is stored. However, 
Eytchison teaches store the control point identity and the functionalities as a control 
point (i.e. server stores policy statements, or information about the user and their 
functionalities, (page 11)). Masuouka and Eytchison are analogous art because they are 
from the same field of endeavor of allowing a user to access devices based on access 
permissions. At the time of the invention, it would have been obvious to one of ordinary 
skill in the art, having the teachings of Masuouka and Eytchison before him or her, to 
modify the system of Masuouka with the teachings of Eytchison in order to protect 
devices from access by unauthorized users (Eytchison, page 3). The motivation for 
doing so would have been to add a user-dependent access control system for a network 
of electronic devices (Eytchison, page 3). Therefore, it would have been obvious to 
combine Eytchison with Masuouka to obtain the invention as specified in the instant 
claim(s). 

With respect to claim 19, Masuouka teaches identify a user wanting to access 
services at a point of access for the user to 15 the computing environment by using a 
control point identifier (i.e. user requests access to the environment using a control point 
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identifier, or pin, [0014]), determine if there is a control point associated with the user 
existing at the point of access (i.e. system determines if pin and user are valid for the 
point of access, [0156]). Masuouka does not explicitly disclose how a control point is 
registered on a security console. However, Eytchison teaches computer program code 
means, to make the computer execute, when said program element is loaded In the 
computer (claim 26), copy, if there is no such control point at the point of access, the 
control point to the point of access (i.e. if user has not already set up a profile, request 
will be sent for services (page 14)), activate the control point (i.e. system grants service 
request if all needed information is available, and the resource manager will 
automatically configure the devices of the network accordingly, (page 14)), and connect 
the control point with a device, such that the user can access services from the device 
in dependence of the rights granted to him (i.e. user will be allowed access to the 
devices to which he has privilege, (page 14)). Masuouka and Eytchison are analogous 
art because they are from the same field of endeavor of allowing a user to access 
devices based on access permissions. At the time of the invention, it would have been 
obvious to one of ordinary skill in the art, having the teachings of Masuouka and 
Eytchison before him or her, to modify the system of Masuouka with the teachings of 
Eytchison in order to protect devices from access by unauthorized users (Eytchison, 
page 3). The motivation for doing so would have been to add a user-dependent access 
control system for a network of electronic devices (Eytchison, page 3). Therefore, it 
would have been obvious to combine Eytchison with Masuouka to obtain the invention 
as specified in the instant claim(s). 



Application/Control Number: 

10/578,067 

Art Unit: 2169 



Page 17 



Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Alexandria Y. Bromell whose telephone number is 571- 
270-3034. The examiner can normally be reached on M-R 6:30-5. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Mohammad Ali can be reached on 571-272-4105. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Alexandria Y Bromell 

Examiner 

Art Unit 2169 




